Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue.

Affected: Packagist: filament/tables, Packagist: filament/infolists

### Summary

If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered.

Versions of Filament from v3.0.0 through v3.2.114 are affected.

Please upgrade to Filament [v3.2.115](https://github.com/filamentphp/filament/releases/tag/v3.2.115).

### PoC

For example, using a value such as:

```html blue;"><script>alert('There\'s a security problem here')</script style=" ```

Would get passed into the `@style()` Blade directive from Laravel to render the correct background color, where `$state` contains the value:

```blade <div @style([ "background-color: {$state}" => $state, ])></div> ```

Since Laravel does not escape special characters within the `@style` Blade directive, the effective output HTML would be:

```html <div style="background-color: blue;"><script>alert('There\'s a security problem here')</script style=""></div> ```

Creating the opportunity for arbitrary JS to run if it was stored in the database.

### Response

This vulnerability (in `ColorColumn` only) was reported by @sv-LayZ, who reported the issue and patched the issue during the evening of 25/09/2024. Thank you Mattis.

The review process concluded on 27/09/2024, which revealed the issue was also present in `ColorEntry`. This was fixed the same day and Filament [v3.2.115](https://github.com/filamentphp/filament/releases/tag/v3.2.115) fo…